CVE-2012-5367 in OrangeHRM

Resumen (Inglés)

Multiple SQL injection vulnerabilities in OrangeHRM 2.7.1 RC 1 allow remote authenticated administrators to execute arbitrary SQL commands via the sortField parameter to (1) viewCustomers, (2) viewPayGrades, or (3) viewSystemUsers in symfony/web/index.php/admin/, as demonstrated using cross-site request forgery (CSRF) attacks.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Reservar

2012-10-10

Divulgación

2012-12-03

Estado

Confirmado

Voces

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerabilidad	CWE	Exp	Con	CVE
63114	OrangeHRM inyección SQL	89	Prueba de concepto	No está definido	CVE-2012-5367

Fuentes

• MITRE
• NVD
• CVE Details